[distro-setup] / conflink

#!/bin/bash

source /a/bin/errhandle/err
err-cleanup() {
  echo 1 >~/.local/conflink
}


usage() {
  cat <<EOF
Usage: ${0##*/} [OPTIONS]
Link or otherwise install configuration files.

-f   For fast. Dont use lnf, use ln -sf. Good for updating existing files.
EOF
  exit $1
}


m() {
  echo "$*"
  "$@"
}
s() { sudo "$@"; }

lnf() { /a/exe/lnf "$@"; }

fast=false
if [[ $1 == -f ]]; then # f for fast
  fast=true
  shift
elif
  [[ $1 ]]; then
  echo "error: unrecognized arguments" >&2
  exit 0
fi

if $fast; then
  lnf() { ln -sf "$@"; }
fi

shopt -s nullglob
shopt -s extglob
shopt -s dotglob

# If we make a link back to the root, we stop going deeper into subdir_files.
# This makes it so we can do subdir directories. eg
# /p/c/subdir_files/.config/gajim -> ../../gagim
#
# Also note, under filesystem/, symlinks are expanded.

subdir-link-r() {
  local root="$1"
  local targets=()
  if [[ $2 ]]; then
    targets=( "$2"/!(.git|..|.|.#*) )
  else
    for f in "$1"/!(.git|..|.|.#*); do
      if [[ -d $f ]]; then targets+=("$f"); fi
    done
  fi
  local below
  below="$( readlink -f "$root/..")"
  for path in "${targets[@]}"; do
    local fullpath
    fullpath="$(readlink -f "$path")"
    if [[ -f $path || $(dirname "$fullpath") == "$below" ]]; then
      m lnf -T "$path" "$HOME/${path#$root/}"
    elif [[ -d "$path" ]]; then
      subdir-link-r "$root" "$path"
    fi
  done
}


common-file-setup() {
  local dir fs x f reload_systemd
  local -a reload_services
  local -a restart_services
  reload_systemd=false
  for dir in "$@"; do
    fs=$dir/filesystem
    if [[ -e $fs && $user =~ ^iank?$ ]]; then
      cmd=( s rsync -aiSAX --chown=root:root --chmod=g-s
            --exclude=/etc/dovecot/users
            --exclude='/etc/exim4/passwd*'
            --exclude='/etc/exim4/*.pem'
            $fs/ / )
      echo "${cmd[@]@Q}"
      while read -r line; do
        file="${line:12}"
        case $file in
          etc/systemd/system/*)
            reload_systemd=true
            ;;
          etc/dnsmasq.d/*)
            restart_services+=(dnsmasq)
            ;;
          etc/systemd/resolved.conf.d/*)
            restart_services+=(systemd-resolved)
            ;;
        esac
        # Previously did this with tar, but it doesn't
        # update directory permissions.
        #
        # S = do spare files efficiently
        # A = preserve acls
        # X = preserve extended attributes
        # i = itemize
      done < <("${cmd[@]}")
    fi

    if [[ -e $dir/subdir_files ]]; then
      m subdir-link-r $dir/subdir_files
    fi
    local x=( $dir/!(binds|subdir_files|filesystem|machine_specific|..|.|.#*) )
    (( ${#x[@]} >= 1 )) || continue
    m lnf ${x[@]} ~
  done
  if $reload_systemd; then
    m s systemctl daemon-reload
  fi
  for service in ${restart_services[@]}; do
    if systemctl is-active $service >/dev/null; then
      m s systemctl restart $service
    fi
  done
}

user=$(id -un)
all_dirs=({/a/bin/ds,/p/c}{,/machine_specific/$HOSTNAME})
# note, we assume a group of hosts does not have the
# same name as a single host, which is no problem on our scale.
for x in /p/c/machine_specific/*.hosts /a/bin/ds/machine_specific/*.hosts; do
  if grep -qxF $HOSTNAME $x; then all_dirs+=( ${x%.hosts} ); fi
done

# old files 2022-03
for t in systemstatus epanicclean btrfsmaintstop dynamicipupdate; do
  f=/etc/systemd/system/$t.timer
  if [[ -e $f ]]; then
    s systemctl stop $t.timer
    s systemctl disable $t.timer
    s rm -fv $f
    reload_systemd=true
  fi
done

c_dirs=(/a/c{,/machine_specific/$HOSTNAME})
case $user in
  iank)
    /a/bin/ds/install-my-scripts
    files=(/p/c/machine_specific/*/filesystem/etc/ssh/*_key
           /p/c/machine_specific/*/filesystem/etc/openvpn/client/*.key
           /p/c/filesystem/etc/openvpn/client/*.key
           /p/c/filesystem/etc/openvpn/easy-rsa/keys/*.key
          )
    if [[ -e ${files[0]} ]]; then
      chmod 600 ${files[@]}
    fi
    # p needs to go first so .ssh link is created, then config link inside it
    m common-file-setup ${all_dirs[@]}

    #### begin special extra stuff ####
    install -d -m700 ~/gpg-agent-socket

    f=/var/lib/bind
    if [[ -e $f ]]; then
      # reset to the original permissions.
      m s chgrp -R bind $f
      m s chmod g+w $f
    fi
    sudo bash -c 'shopt -s nullglob; for f in /etc/bind/*.key /etc/bind/*.private /etc/bind/key.*; do chgrp bind $f; done'
    if [[ -e /etc/caldav-htpasswd ]] && getent group www-data &>/dev/null; then
      s chgrp www-data /etc/caldav-htpasswd
    fi
    if [[ -e /var/lib/znc ]] && getent group znc; then
      s chown -R znc:znc /var/lib/znc
    fi
    for f in /etc/prometheus-{,export-}htpasswd; do
      if [[ -e $f ]]; then
        s chmod 640 $f
        if getent passwd www-data; then
          s chown root:www-data $f
        fi
      fi
    done
    f=/etc/prometheus-pass
    if [[ -e $f ]]; then
      # note: this is duplicative of the file's own permissions
      s chmod 640 $f /etc/prometheus-pass
      if getent passwd prometheus; then
        s chown root:prometheus $f
      fi
    fi


    ##### end special extra stuff #####

    m sudo -H -u user2 "${BASH_SOURCE[0]}"

    f=/a/bin/distro-setup/system-status
    if [[ -x $f ]]; then
      $f _
    fi
    mkdir -p ~/.local
    echo 0 >~/.local/conflink

    ;;
  user2)
    m common-file-setup ${c_dirs[@]}
    ;;
  *)
    echo "$0: error: unexpected user"; exit 1
    ;;
esac